{{- if eq .Values.manager.kind "DaemonSet" }}
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: {{ include "capsule.controllerName" . }}
  labels:
    {{- include "capsule.labels" . | nindent 4 }}
  {{- with .Values.customAnnotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  updateStrategy:
    type: RollingUpdate
  selector:
    matchLabels:
      {{- include "capsule.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      {{- with .Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "capsule.labels" . | nindent 8 }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "capsule.serviceAccountName" . }}
      {{- with .Values.podSecurityContext }}
      securityContext:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- if .Values.manager.hostNetwork }}
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      {{- end }}
      priorityClassName: {{ .Values.priorityClassName }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      volumes:
        - name: cert
          secret:
            defaultMode: 420
            secretName: {{ include "capsule.secretTlsName" . }}
      containers:
        - name: manager
          command:
          - /manager
          args:
          - --webhook-port={{ .Values.manager.webhookPort }}
          - --enable-leader-election
          - --zap-log-level={{ default 4 .Values.manager.options.logLevel }}
          - --configuration-name=default
          image: {{ include "capsule.managerFullyQualifiedDockerImage" . }}
          imagePullPolicy: {{ .Values.manager.image.pullPolicy }}
          env:
          - name: NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          ports:
            - name: webhook-server
              containerPort: {{ .Values.manager.webhookPort }}
              protocol: TCP
            - name: metrics
              containerPort: 8080
              protocol: TCP
          livenessProbe:
            {{- toYaml .Values.manager.livenessProbe | nindent 12}}
          readinessProbe:
            {{- toYaml .Values.manager.readinessProbe | nindent 12}}
          volumeMounts:
          - mountPath: /tmp/k8s-webhook-server/serving-certs
            name: cert
            readOnly: true
          resources:
            {{- toYaml .Values.manager.resources | nindent 12 }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
{{- end }}
